From 962aa14f240f43ca3bf3516432f7c3a6fbd1d3ff Mon Sep 17 00:00:00 2001
From: Randy Stauner <randy@r4s6.net>
Date: Tue, 4 Nov 2025 13:29:14 -0700
Subject: ZJIT: Add test to reproduce binarytrees crash (#15054)

---
 test/ruby/test_zjit.rb | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

(limited to 'test/ruby')

diff --git a/test/ruby/test_zjit.rb b/test/ruby/test_zjit.rb
index de2d1e6152..ae1af5c2c0 100644
--- a/test/ruby/test_zjit.rb
+++ b/test/ruby/test_zjit.rb
@@ -3164,6 +3164,37 @@ class TestZJIT < Test::Unit::TestCase
     }, call_threshold: 2
   end
 
+  def test_regression_cfp_sp_set_correctly_before_leaf_gc_call
+    omit 'reproduction for known, unresolved ZJIT bug'
+
+    assert_compiles ':ok', %q{
+      def check(l, r)
+        return 1 unless l
+        1 + check(*l) + check(*r)
+      end
+
+      def tree(depth)
+        # This duparray is our leaf-gc target.
+        return [nil, nil] unless depth > 0
+
+        # Modify the local and pass it to the following calls.
+        depth -= 1
+        [tree(depth), tree(depth)]
+      end
+
+      def test
+        GC.stress = true
+        2.times do
+          t = tree(11)
+          check(*t)
+        end
+        :ok
+      end
+
+      test
+    }, call_threshold: 14, num_profiles: 5
+  end
+
   private
 
   # Assert that every method call in `test_script` can be compiled by ZJIT
-- 
cgit v1.2.3